Raw vector
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HSummary
CVE-2025-62594 is a medium-severity Improper Restriction of Operations within the Bounds of a Memory Buffer (CWE-119) vulnerability in Imagemagick Imagemagick. Its CVSS base score is 4.7 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-2 (Flaw Remediation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-36365
Vulnerability Data
ImageMagick is a software suite to create, edit, compose, or convert bitmap images. ImageMagick versions prior to 7.1.2-8 are vulnerable to denial-of-service due to unsigned integer underflow and division-by-zero in the CLAHEImage function. When tile width or height is zero,…
more
unsigned underflow occurs in pointer arithmetic, leading to out-of-bounds memory access, and division-by-zero causes immediate crashes. This issue has been patched in version 7.1.2-8.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability enables an application-layer denial-of-service via out-of-bounds memory access and division-by-zero in the CLAHEImage function, directly mapping to T1499.004 (Endpoint Denial of Service: Application or System Exploitation).
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires applying the vendor patch (7.1.2-8) that eliminates the unsigned underflow and divide-by-zero in CLAHEImage.
Enforces validation of image metadata (tile width/height) before CLAHE processing, blocking the zero-value inputs that trigger CWE-191/CWE-369.
Provides memory protection mechanisms that can contain or prevent exploitation of the out-of-bounds access (CWE-119) resulting from the underflow.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent integer underflow defects via input validation, bounds checking, and static analysis.
Vulnerability scanning and code analysis directly surface buffer-boundary flaws.
Receiving and triaging vulnerability disclosures commonly includes buffer-related reports.
Developer training on secure coding reduces introduction of memory-buffer errors.
Patching replaces vulnerable code containing buffer-boundary defects.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development catches out-of-bounds accesses before release, covering most instances of the weakness.
Secure development lifecycle mandates memory-safety practices that directly prevent buffer-boundary violations.
Application security requirements can specify memory-safety rules, but do not prescribe implementation details.
Secure architecture and engineering principles include memory-safe design patterns that mitigate buffer overflows.
Secure coding standards explicitly forbid unsafe buffer operations, directly eliminating CWE-119.